CVE-2016-2775: fedoraproject fedora Improper Input Validation

Modified

AliasesRHBA-2017:0651RHBA-2017:1767RHSA-2017:2533+2 more

Published 19-07-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-2775 is a medium (CVSS 5.9) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 63.35% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.9/10

010

Medium · v3.1 (NVD)

EPSS score

63.35%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 5

DLA-645-1 DSA-3680-1 MGASA-2016-0332 OPENSUSE-SU-2024:10650-1 SUSE-SU-2017:0998-1 SUSE-SU-2017:0999-1+2 more

Timeline

19-07-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

CVSS metrics

6 scores · 4 sources · 3 versions

v3.15.9v3.05.9v2.04.3

EPSS trend

Probability

63.35%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 63.35% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat21 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_eus7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.2 | 7.3 | 7.6 | 7.7
enterprise_linux_server_tus7.2 | 7.3 | 7.6 | 7.7

Show all 21

Debian1 product

bind9< 1:9.10.3.dfsg.P4-11

Fedoraproject1 product

fedoraEOL23 | 24

Hp1 product

hp-uxb.11.31

Isc1 product

bind≥ 9.0, ≤ 9.9.8 | ≥ 9.10.0, ≤ 9.10.3 | 9.9.9 | 9.9.9:b1 | 9.9.9:b2 | 9.9.9:p1 | 9.9.9:rc1 | 9.9.9:s1 | 9.9.9:s1rc1 | 9.10.4 | 9.10.4:beta1 | 9.10.4:beta2 | 9.10.4:beta3 | 9.10.4:p1 | 9.11.0 | 9.11.0:alpha1 | 9.11.0:alpha2 | 9.11.0:alpha3 | 9.11.0:beta1

Ubuntu1 product

bind9< 1:9.9.5.dfsg-3ubuntu0.19+esm9 | < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm5

6 vendors · 26 products

References

40 links

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
kb.isc.org/article/AA-01438X Refsource CONFIRMBroken Link
access.redhat.com/errata/RHBA-2017:1767Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.securityfocus.com/bid/92037VDB EntryX Refsource BIDThird Party Advisory
security.gentoo.org/glsa/201610-07Vendor AdvisoryX Refsource GENTOOThird Party Advisory
kb.isc.org/article/AA-01435X Refsource CONFIRMBroken Link
access.redhat.com/errata/RHBA-2017:0651Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
kb.isc.org/article/AA-01393/74/CVE-2016-2775X Refsource CONFIRMPatchVendor AdvisoryREPORT

Show all 40 references

www.securitytracker.com/id/1036360VDB EntryX Refsource SECTRACKThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2017:2533Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
kb.isc.org/article/AA-01436X Refsource CONFIRMBroken Link
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05321107X Refsource CONFIRMPatchVendor Advisory
security.netapp.com/advisory/ntap-20160722-0002/X Refsource CONFIRMThird Party Advisory
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.htmlARTICLE
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1259923REPORT
bugzilla.redhat.com/show_bug.cgi?id=1297562REPORT
bugzilla.redhat.com/show_bug.cgi?id=1313286REPORT
bugzilla.redhat.com/show_bug.cgi?id=1321239REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhba-2017_0651.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-2775REPORT
bugzilla.redhat.com/show_bug.cgi?id=1357803REPORT
www.cve.org/CVERecord?id=CVE-2016-2775AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-2775Advisory
kb.isc.org/article/AA-01393/ARTICLE
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1271315REPORT
bugzilla.redhat.com/show_bug.cgi?id=1388534REPORT
bugzilla.redhat.com/show_bug.cgi?id=1392362REPORT
bugzilla.redhat.com/show_bug.cgi?id=1392531REPORT
bugzilla.redhat.com/show_bug.cgi?id=1393886REPORT
security.access.redhat.com/data/csaf/v2/advisories/2017/rhba-2017_1767.jsonAdvisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2533.jsonAdvisory
ubuntu.com/security/CVE-2016-2775REPORT
ubuntu.com/security/notices/USN-5747-1Advisory
security-tracker.debian.org/tracker/CVE-2016-2775Advisory